CORPORATE GOVERNANCE REGULATION THROUGH NON- PROSECUTION

Transcription

1 NELLCO NELLCO Legal Scholarship Repository New York University Law and Economics Working Papers New York University School of Law CORPORATE GOVERNANCE REGULATION THROUGH NON- PROSECUTION Jennifer Arlen NYU School of Law, Marcel Kahan NYU School of Law, Follow this and additional works at: Part of the Criminal Law Commons, Law and Economics Commons, and the Public Law and Legal Theory Commons Recommended Citation Arlen, Jennifer and Kahan, Marcel, "CORPORATE GOVERNANCE REGULATION THROUGH NON-PROSECUTION" (2016). New York University Law and Economics Working Papers. Paper This Article is brought to you for free and open access by the New York University School of Law at NELLCO Legal Scholarship Repository. It has been accepted for inclusion in New York University Law and Economics Working Papers by an authorized administrator of NELLCO Legal Scholarship Repository. For more information, please contact

2 CORPORATE GOVERNANCE REGULATION THROUGH NON-PROSECUTION Jennifer Arlen and Marcel Kahan * Abstract Over the last decade, federal corporate criminal enforcement policy has undergone a significant transformation. Firms that commit crimes are no longer simply required to pay fines. Instead, prosecutors and firms enter into pretrial diversion agreements (PDAs). Prosecutors regularly use PDAs to impose mandates on firms creating new duties that alter firms internal operations or governance structures. This Article evaluates PDA mandates to determine whether and when prosecutors can appropriately use them to deter corporate crime. We find that mandates can be justified. But, contrary to DOJ policy favoring mandates for any firm with a deficient compliance program at the time of the crime, we find that mandates should be imposed more selectively. Specifically, mandates are only appropriate if a firm is plagued by policing agency costs in that the firm s managers did not act to deter or report wrongdoing because they benefitted personally from tolerating wrongdoing or from deficient corporate policing. We show that this policing agency cost justification provides guidance on how to reform federal policy to make appropriate use of mandates, guidance which reveals that many mandates are inappropriate. * Norma Z. Paige Professor of Law, New York University School of Law and George T. Lowy Professor of Law at New York University School of Law, respectively. We benefited from helpful comments from David Abrams, Cindy Alexander, Miriam Baer, Rachel Barkow, Jayne Barnard, Michal Barzuza, Samuel Buell, Oscar Couwenberg, Brandon Garrett, Edward Iacobucci, Louis Kaplow, Michael Klausner, Brett McDonnell, Mark Ramseyer, Eva Schliephake, Steven Shavell, Matthew Spitzer, Abraham Wickelgren, Josefien van Zeben, and participants at the Business Law Section of the Association of American Law Schools annual meeting, European Law and Economics Association annual meeting, and participants at workshops at Brooklyn Law School, University of California at Los Angeles School of Law, Columbia University School of Law, ETH Zurich, Harvard Law School, NYU School of Law, University of Pennsylvania Law School of Law, University of Pompeu Fabra, Queens Law School, Stanford Law School, University of Texas Law School Law and Economics Colloquium, University of Toronto Faculty of Law, University of Virginia School of Law, and University of Western Ontario Faculty of Law. We also would like to thank Brandon Garrett and Vic Khanna for sharing their data on PDAs which we compared to our own hand-collected dataset. We also thank Brandon Arnold, Rachel Lu Chen, Elias Debbas, Josh Levy, Reagan Lynch, Matt Mutino, Alice Phillips, Jared Roscoe, KyungEun Kimberly Won, and Donna Xu, for excellent research assistance, with special thanks to Tristan Favro, Katya Roze, and Cristina Vasile. We are grateful for the financial support of the D Agostino/Greenberg Fund of New York University School of Law.

3 CORPORATE GOVERNANCE REGULATION THROUGH NON-PROSECUTION I. INTRODUCTION Over the last decade, corporate criminal enforcement in the U.S. has undergone a dramatic transformation. Federal officials no longer simply fine publicly held firms that commit crimes. Instead, they use their enforcement authority to impose mandates on these firms mandates that can require firms to alter their compliance program, governance structure, or scope of operations. 1 Prosecutors generally impose mandates through pretrial diversion agreements (PDAs). In a PDA, the prosecutor agrees not to pursue a criminal conviction of a firm. In return, the firm typically agrees to pay a fine and cooperate in the investigation. In addition, PDAs usually contain mandates that govern the firm s future behavior. These mandates may require the firm to adopt a corporate compliance program with specified features, to alter its internal reporting structure, to add specific individuals to the board of directors, to modify certain business practices, or to hire a prosecutor-approved corporate monitor. 2 Prosecutors use of PDAs to impose such mandates fundamentally alters both the structure of corporate criminal law and the role of the prosecutor. 3 Traditionally, federal enforcement policy has in effect imposed a form of corporate criminal liability that is both harm-contingent and duty-based. Firms that commit a substantive criminal violation 4 are subject to heightened fines (and are more likely to face formal conviction) if they also failed to comply with ex ante duties 5 designed to help detect a crime and sanction wrongdoers 1 PDA mandates can be imposed on any firm but generally are imposed on publicly held firms and their controlled subsidiaries. See Cindy R. Alexander and Mark A. Cohen, The Evolution of Corporate Criminal Settlements: An Empirical Perspective on Non-Prosecution, Deferred Prosecution, and Plea Agreements, 52 AMER. CR. L. REV. 573, 589 (2015) (showing that compliance and related mandates are more commonly included in PDAs than in guilty pleas with publicly held firms and their controlled subsidiaries). 2 See generally, Brandon L. Garrett, Structural Reform Prosecution, 93 VA. L. REV. 853, (2007); Peter Spivack & Sujit Raman, Regulating the New Regulators : Current Trends in Deferred Prosecution Agreements, 45 AM. CRIM. L. REV. 159, 186 (2008); Lawrence D. Finder, Ryan D. McConnell, & Scott L. Mitchell, Betting the Corporation: Compliance or Defiance? Compliance Programs in the Context of Deferred and Non Prosecution Agreements: Corporate Pre-trial Agreement Update 2008, 28 CORP. COUNS. REV. 1, 2 4 (2009); see also Vikramaditya Khanna & Timothy L. Dickinson, The Corporate Monitor: The New Corporate Czar, 105 MICH. L. REV. 1713, 1724 (2007) (discussing corporate monitor provisions in PDAs). 3 Prosecutors can impose mandates on firms through PDAs or guilty pleas. The conclusions we reach regarding the appropriate purposes and forms of PDA mandates applies as well to mandates imposed through corporate guilty pleas. 4 Throughout this Article we use the terms substantive crime, substantive violation, substantive wrongdoing and harm to refer to wrongdoing that causes direct immediate social harm e.g., wire fraud, bribery, etc. We distinguish such substantive violations from violations taking the form of failing to undertake corporate policing intended to deter and detect substantive violations (e.g., a failure to have an independent audit). 5 Although the law does not technically require all firms to adopt an effective compliance program and selfreport, the existing regime can be characterized as imposing duties to adopt an effective compliance program, selfreport and cooperate enforced by harm-contingent sanctions in that firms that fail to take these actions face higher sanctions for detected wrongdoing than those that do undertake them under the Organizational Sentencing Guidelines. United States Sentencing Commission, U.S. Sentencing Guidelines Governing Organizations, 8C2.5

4 CORPORATE GOVERNANCE REGULATION THROUGH NON-PROSECUTION 2 specifically, if they failed to adopt an effective compliance program, to self-report detected wrongdoing, and to cooperate with investigations by federal authorities ( policing duties ). 6 Firms that satisfy these policing duties generally avoid formal conviction and are subject to lower monetary sanctions. This regime for determining criminal monetary sanctions is harmcontingent because firms can usually only be sanctioned if a substantive crime occurred. It is duty-based because sanctions do not depend simply on whether a substantive crime occurred, but rather are contingent on (or enhanced by) the firm s failure to comply with ex ante policing duties. PDA mandates deviate from this traditional regime in two ways. First, the policing duties in PDA mandates are imposed ex post, on select firms with detected wrongdoing, rather than generally applicable ex ante. Indeed, mandated duties not only are imposed after a substantive violation occurs, but the content of the mandates is often determined only at that time. Thus firms do not know beforehand what additional duties they will become subject to should they commit a substantive violation and become subject to a PDA mandate. Second, liability for violating PDA mandates is not harm-contingent. That is, a mere violation of the firm s ex post policing mandate, without the commission of (another) substantive violation, exposes the firm to liability. In combination, these two features of PDA mandates transform prosecutors into firmspecific quasi-regulators. Prosecutors can impose specific duties on a subset of firms with alleged wrongdoing; and they enforce compliance with these duties through sanctions for a mere failure to comply with the duty, even if no substantive crime occurs. Department of Justice ( DOJ ) policy has promoted this transformation by encouraging broad use of PDA mandates. DOJ policy in effect encourages prosecutors to impose mandates on any firm with detected wrongdoing that did not have an effective compliance program at the time of the crime. The DOJ, however, has not adopted any effective standards governing what mandates to impose. 7 Unsurprisingly, this assertion by prosecutors of quasi-regulatory authority has given rise to charges of prosecutorial abuse of discretion 8 and calls for greater DOJ guidance. 9 There is (f)-(g) (2014). In addition, federal enforcement authorities focus on effective compliance, self-reporting and cooperating in deciding whether to indict a firm or give it a PDA. See infra Section II.A. 6 Policing measures are measures that increase the probability that a crime is detected or sanctioned. By contrast, prevention measures deter by reducing employees direct incentives to commit the crime. Jennifer Arlen & Reinier Kraakman, Controlling Corporate Misconduct: An Analysis of Corporate Liability Regimes, 72 N.Y.U. L. REV. 687 (1997) (defining corporate policing)). 7 Accord Garrett, supra note 3, at 893( [N]o DOJ guidelines define what remedies prosecutors should seek when they negotiate structural reform agreements. ). By contrast, the DOJ has issued guidance on a variety of other issues relating to corporate prosecutions, including (1) whether to impose extraordinary restitution, (2) when to seek a waiver of the attorney-client privilege, and (3) the decision to impose a corporate monitor; Jennifer Arlen, Prosecuting Beyond the Rule of Law: Corporate Mandates Imposed Through Pretrial Diversion Agreements, J. LEGAL ANALYSIS (forthcoming 2016). 8 See infra notes 52 and 42 (discussing examples of prosecutorial abuse of discretion in this area). 9 See Garrett, supra note 3; Spivak & Raman, supra note 2; see Lawrence Cunningham, Deferred Prosecutions and Corporate Governance: An Integrated Approach to Investigations and Reform, 66 FLA. L. REV. 1

5 Jennifer Arlen & Marcel Kahan 3 little doubt that greater DOJ guidance and oversight is needed. 10 Yet, to provide effective guidance, one must first address two fundamental questions. First, when, if ever, should prosecutors use PDAs to create and impose corporate governance mandates on firms with detected wrongdoing? Second, in situations where mandates are justified, which types of mandates plausibly enhance social welfare? In this Article, we seek to answer these questions by determining whether, and when, the imposition of compliance programs and other mandates through PDAs is an efficient component of the overall liability regime. In particular, we identify the situations where the most costeffective way to deter corporate crime is for prosecutors to impose PDA mandates. The circumstances in which mandates are desirable, in turn, determine what mandates are justified. We then use our analysis to show how existing DOJ policy should be modified to ensure that mandates are only imposed when, and in the form that is, appropriate. We begin by identifying the central goal of corporate criminal liability for publicly-held firms: to induce optimal corporate policing. We show that this goal is generally best achieved through a regime, such as the traditional corporate criminal liability regime, where sanctions are imposed on firms that breached their policing duties and committed a substantive wrong. Mandates are neither needed nor desirable. 11 Nevertheless, enforcement authorities cannot rely entirely on such a duty-based, harmcontingent liability regime. We identify three circumstances where duty-based, harm-contingent liability may not be able to induce firms to undertake optimal corporate policing: corporate asset insufficiency, policing agency costs, and the need for targeted duties. Yet these situations do not all justify the use of PDA mandates. Examining these three situations, we find that only one of these policing agency costs justifies granting prosecutors the authority to create and impose mandates on select firms with detected wrongdoing. The other potential problems are more appropriately addressed through ex ante regulations or modifications in the harm-contingent regime, rather than through PDA mandates. Traditional corporate liability or ex ante regulations, however, may be ineffective when firms are plagued by policing agency costs because, by definition, top managers of these firms benefit personally from either tolerating wrongdoing or from deficient policing. Thus, they cannot be relied on to act in the firm s best interests when designing or overseeing compliance or deciding whether to self-report and cooperate. Therefore, to combat policing agency costs, duties must be designed to impose personal costs on managers for tolerating deficient policing or shift authority over policing to persons who do not suffer from policing agency costs. As we explain, this generally requires that the firms (2014). Indeed, some commentators have gone beyond calls for guidance and have exhorted the DOJ to abandon PDAs altogether. See David M. Uhlmann, Deferred Prosecution and Non-Prosecution Agreements and the Erosion of Corporate Criminal Liability, 72 MD. L. REV (2013). 10 E.g., Arlen, supra note Arlen & Kraakman, supra note 6 (identifying corporate policing and prevention as the two central goals of corporate liability); see also Jennifer Arlen, The Potentially Perverse Effects of Corporate Criminal Liability, 23 J. LEGAL STUD. 833 (1994) (explaining that a central goal of corporate liability is to induce firms to help increase the probability that the wrongful employees are sanctioned).

6 CORPORATE GOVERNANCE REGULATION THROUGH NON-PROSECUTION 4 subject to such duties are clearly identified. But firms with severe policing agency costs are not readily identifiable ex ante. This makes it difficult to impose effective duties ex ante. PDAs mandates are a potentially effective solution because prosecutors should be able to both identify firms with policing agency costs ex post and employ information gained in the investigation to remedy the problem. We conclude by evaluating the implications of our analysis for existing DOJ policy and for potential reforms. First, the current policy of encouraging prosecutors to impose PDA mandates whenever a firm with detected wrongdoing had a deficient compliance program is not justified. Rather, such mandates should be imposed only if the firm suffered from substantial policing agency costs. Although identifying firms with policing agency costs inevitably requires ex post firmspecific analysis of the firm s policing, we identify factors that indicate that policing agency costs either do not explain previous deficient policing or are unlikely to be present in the future. In particular, policing agency costs are unlikely to be significant, and thus PDA mandates generally are not appropriate, when a publicly-held firm has a controlling shareholder with sufficient power and incentives to induce managers to act in the firm s best interest. Similarly, mandates are likely inappropriate when top managers proactively responded to suspected wrongdoing by taking reasonable, good faith steps to investigate the wrongdoing, report it to the enforcement authorities, and cooperate in their investigation. Such actions suggest that any deficiencies in the compliance program were inadvertent and not caused by policing agency costs. Finally, PDA mandates are questionable when the firm, after the substantive violation occurred, underwent a transformative change, such as a change in control, that affected the previously prevailing policing agency cost structure. Finally, we consider the implications of our analysis for the type of mandates that should be imposed. Even when policing agency costs are present and likely to continue, PDA mandates are only justified to the extent that they are effectively designed to reduce policing agency costs. To do this, PDAs must either impose precise duties falling on specific people who should expect to be held accountable for breach of the duties; or shift responsibility over policing to those not afflicted by agency costs, such as outside directors or external monitors. Mandates that are not designed to reduce policing agency costs, or mandates designed to improve corporate governance generally, rather than policing agency costs specifically, are generally inappropriate. This Article proceeds as follows. Part II shows how PDA mandates transform corporate criminal liability. Part III examines optimal corporate liability. Part IV identifies situations where harm-contingent liability may not be effective and finds that only one situation, policing agency costs, justifies the use of PDA mandates. Part V examines the implications of our analysis for existing DOJ policy and presents suggestions for reform. Part VI concludes. II. CORPORATE CRIMINAL ENFORCEMENT AND PDAS This Part examines corporate criminal enforcement policy as applied to publicly-held firms. In Section A, we describe the federal corporate liability regime applied to such firms. In Section B, we review the use and typical terms of PDAs. In Section C, we show how PDA-

7 Jennifer Arlen & Marcel Kahan 5 imposed mandates fundamentally change the structure of corporate criminal liability from a regime that relies on harm-contingent sanctions to enforce generally applicable policing duties imposed upfront to a regime where select firms are subject to differing policing duties that are both created and imposed ex post, (after a substantive violation occurs) and that are enforced by sanctions that are not harm-contingent. A. U.S. Corporate Criminal Enforcement In the U.S., corporations can be held strictly criminally liable 12 for crimes committed by employees in the scope of employment through the doctrine of respondeat superior. 13 The scope of this liability is unusually broad. Corporations can be held criminally liable for crimes committed by low-level employees, 14 contrary to corporate directives, 15 or notwithstanding the firm s adoption of an effective compliance program. 16 Convicted corporations can be subject to substantial monetary sanctions, including fines, restitution, and remediation, as well as nonmonetary sanctions (such as corporate probation). They also may be subject to civil penalties and administrative sanctions. 17 Administrative sanctions can include delicensing and debarment from contracting with federal agencies with potentially ruinous consequences for the firm. 18 Yet, in practice, federal prosecutors do not hold publicly-traded corporations strictly liable for their employees crimes. 19 Instead, the Department of Justice instructs prosecutors to 12 Corporations are strictly criminally liable in the sense that in the U.S. firms are liable for all crimes committed by employees in the scope of employment even if the firm did all it reasonably could to prevent the crime and no member of senior management or the board participated in or condoned the crime. 13 Individuals also are criminally liable for crimes committed with the requisite mens rea even if they acted on behalf of the firm and were following instructions. 14 E.g., United States v. Dye Constr. Co., 510 F.2d 78 (10th Cir. 1975); Tex.-Okla. Express, Inc. v. United States, 429 F.2d 100 (10th Cir. 1975); Riss & Co. v. United States, 262 F.2d 245 (8th Cir. 1958); United States v. George F. Fish, Inc., 154 F.2d 798 (2d Cir. 1946). 15 E.g., United States v. Twentieth Century Fox Film Corp., 882 F.2d 656 (2d Cir. 1989); United States v. Hilton Hotels Corp., 467 F.2d 1000 (9th Cir. 1972), cert. denied 409 U.S (1973); United States v. Ionia Mgmt. S.A., 555 F.3d 303 (2d Cir. 2009). 16 Under the Organizational Sentencing Guidelines, a corporation that had effective compliance programs, self-reported and cooperated is eligible for a reduced fine. See supra note 5. Yet the mitigation granted to larger firms is too low to incentivize firms to undertake effective compliance or self-reporting. Jennifer Arlen, The Failure of the Organizational Sentencing Guidelines, 66 U. MIAMI L. REV. 321 (2012) (symposium issue). Moreover, convicted firms remain subject to the collateral penalties triggered by indictment or conviction, such as debarment, that can discourage corporate policing. 17 Non-fine sanctions plus civil penalties often dwarf the criminal fine. See Cindy Alexander, Jennifer Arlen, & Mark Cohen, Regulating Corporate Criminal Sanctions: Federal Guidelines and the Sentencing of Public Firms, 42 J. L. & ECON. 393, 410 (1999) (providing empirical evidence). 18 See Miriam H. Baer, Governing Corporate Governance, 50 B.C. L. REV. 949 (2009). 19 The USAM guidelines apply to all firms. Yet prosecutors tend to impose PDAs on firms where control is separated from day to day management, such as publicly held firms. Owner-managed firms tend not to receive PDAs because owner-managers often are implicated in their firm s criminal activity; these firms thus are unlikely to self-report and cooperate in return for leniency. See Jennifer Arlen, Corporate Criminal Liability: Theory and Evidence, , in RESEARCH HANDBOOK ON CRIMINAL LAW (Keith Hylton & Alon Harel, eds.) (2012) (finding that substantially more publicly-traded firms obtain PDAs than are convicted of crime governed by the Organizational Sentencing Guidelines). Indeed, there is evidence that prosecutors are particularly inclined to use

8 CORPORATE GOVERNANCE REGULATION THROUGH NON-PROSECUTION 6 consider alternatives to criminal conviction based on a variety of factors, including (and especially) whether the firm maintained an effective compliance program, self-reported, and cooperated in the investigation of the wrongdoing. 20 Firms that fully self-report the wrong prior to threat of detection and cooperate are rarely prosecuted. 21 Firms that avoid prosecution are generally subject to pretrial diversion agreements (PDAs). 22 PDAs enable prosecutors to sanction the firm without triggering the collateral consequences of a formal conviction. 23 Thus, in practice, the corporate liability governing publicly held firms is not strict but instead resembles what one of us has called composite liability. Under composite liability, firms are subject to both duty-based criminal liability and a residual layer of strict liability. Duty-based liability imposes general upfront duties on all firms to adopt an effective compliance program, self-report detected wrongdoing, and fully cooperate with the government s investigation ( policing duties ). Firms that breach these policing duties are subject to enhanced sanctions including criminal conviction with enhanced fines if a substantive violation occurs. 24 By contrast, firms that satisfy all of these policing duties avoid formal conviction. These firms nevertheless are liable for the misconduct, but face substantially lower sanctions, often imposed through PDAs. 25 PDAs to sanction parent corporations. See Alexander & Cohen, supra note 1, at 580 (finding that, from , 58% of criminal resolutions with parent corporations were done through PDAs; by contrast 70% of criminal resolutions with subsidiaries involved guilty pleas). 20 Then-Deputy Attorney General Eric Holder issued the first guidelines to federal prosecutors in The Holder memo detailed factors prosecutors should consider in deciding whether to indict a firm. Memorandum from Eric Holder, Deputy Attorney General, U.S. Dep t of Justice, to Heads of Department Components and United States Attorneys (June 16, 1999) [hereinafter Holder Memo]. The current guidelines, which build on the Holder memo, are contained in Principles of Federal Prosecution of Business Organizations, of the United States Attorneys Manual (USAM). 21 Firms also can avoid conviction under other circumstances, including when the firm would be subject to ruinous collateral penalties and agrees to fully cooperate. See USAM Principles of Federal Prosecution of Business Organizations, ; see also General Accounting Office, Preliminary Observations on the Department of Justice s Use and Oversight of Deferred Prosecution and Non-Prosecution Agreements, GAO T (June 25, 2009). 22 In some cases, the DOJ will formally decline to pursue a firm instead of imposing a PDA. The DOJ does not release data on most declinations, and thus it is hard to determine how often this happens. Declination appears to be more likely when the wrongdoing is limited and the firm self-reported and fully cooperated. 23 See USAM It might appear that PDAs also enable the firm to avoid the reputational consequences of a criminal conviction. But under the DOJ s current policy, it is unlikely that the decision of most prosecutors to impose a PDA instead of a guilty plea has a material effect on the reputational sanction, holding constant the nature of the crime and other publicly disclosed information about the firm and the crime. Cindy R. Alexander and Jennifer Arlen Does Conviction Matter?: The Reputational Effects of Corporate Crime, RESEARCH HANDBOOK ON CORPORATE CRIME AND FINANCIAL MISDEALING (Jennifer Arlen ed. forthcoming). 24 See supra note 4 (defining substantive violation and distinguishing it from violations predicated on the failure to comply with policing duties). 25 Arlen & Kraakman, supra note 6; Arlen, supra note 11. For a discussion of when and why firms that satisfy all their policing duties should still bear monetary sanctions if a wrong occurs, see Arlen and Kraakman, supra note 6; Arlen, supra note 7.

9 Jennifer Arlen & Marcel Kahan 7 B. PDAs and Corporate Reform Mandates PDAs have become federal prosecutors primary tool for imposing monetary sanctions and mandates on publicly held firms for offenses, other than antitrust and environmental crimes, since In a conventional PDA, the firm acknowledges that its employees committed the acts that constitute the crime, agrees to waive its right to a speedy trial, and agrees to fully cooperate with the prosecutors investigation. In return for the firm s compliance with the PDA, prosecutors agree to not seek the firm s conviction. Under some PDAs, the prosecutor agrees not to file formal charges against the firm (non-prosecution agreements); under others, the prosecutors files charges but agrees not to seek conviction (deferred prosecution agreements). 27 PDAs thus occupy a middle ground between no criminal sanction and formal conviction, and are often employed with firms that had a deficient compliance program but provided valuable cooperation. PDAs further provide that if a firm fails to comply with the terms of the PDA, the prosecutor can proceed to convict the firm using its statement of facts admitting the crime against it. A firm that fails to comply with a PDA thus faces nearly guaranteed criminal conviction even when it does not commit any subsequent crime. 28 The majority of PDAs require firms to pay fines and other monetary penalties. Monetary penalties imposed through PDAs can be substantial. PDAs entered into by the U.S. Attorney s 26 Alexander and Cohen, supra note 1, at 571; Arlen, supra note 19 (comparing PDAs with federal convictions of publicly held firms). Pre-trial diversion agreements were used prior to 2003, most prominently in the 1994 PDA with Prudential. Mary Jo White, Corporate Criminal Liability: What Has Gone Wrong?, 237TH ANN. INST. SEC. REG. 815, 818 (PLI Corp. Law & Practice, Course Handbook Series No. B-1517, 2005). Nevertheless, the 2003 Thompson memo was the first official endorsement of these agreements, see Memorandum from Larry D. Thompson, Deputy Attorney General, U.S. Dep t of Justice, to Heads of Department Components and United States Attorneys (Jan. 20, 2003) [hereinafter Thompson memo], and dramatically increased their use. In the entire period prior to 2002, prosecutors negotiated only 18 PDAs. See Garrett, supra note 3. By contrast, we find that they entered into at least 267 PDAs from 2004 through 2014 based on our dataset (we exclude agreements involving antitrust, tax, and environmental). See also Alexander and Cohen, supra note 1 (finding prosecutors entered into 155 PDAs against publicly held firms for all crimes from , and only 8 PDAs for antitrust or environmental). PDAs issued after the Thompson memo are more likely to impose firm-specific policing duties and monitors. See Lisa Kern Griffin, Compelled Cooperation and the New Corporate Criminal Procedure, 82 N.Y.U. L. REV. 311, 323 (2007); Spivack & Raman, supra note 2, ; see also Baer, supra note 18, at NPAs are expressed in the form of a letter, often not filed in court. Garrett, supra note 3, at For example, in 2008 the DOJ concluded that Aibel Group failed to meet its obligations under its PDA and revoked its PDA with the firm. The firm pleaded guilty of its original offense and was required to pay a $4.2 million fine and serve two years on organization probation. Press Release, Department of Justice, Aibel Group Ltd. Pleads Guilty to Foreign Bribery and Agrees to Pay $4.2 Million in Criminal Fines (Nov. 21, 2008) Christopher Matthews, Aruna Viswanatha, and Devlin Barrett, US Moves to Tear Up Past UBS Settlement, Wall Street Journal C1 (May 15, 2015) (discussing DOJ s move to convict UBS for 2012 Libor fixing, notwithstanding a 2012 PDA, following discovery of additional wrongs that occurred after that agreement). Courts have held that prosecutors have discretion to determine whether a firm s conduct constitutes a sufficient breach of PDA mandates to justify a decision to indict. E.g., See Stolt-Nielsen v. U.S., 442 F.3d 177 (3 rd Cir. 2006) (federal courts do not have authority to enjoin a prosecutor from indicting a firm that the prosecutor concludes violated a PDA); U.S. v. Goldfarb, No. C WHA, 2012 WL (N.D. Cal. Sept. 5, 2012) (denying motion to dismiss indictment because of claimed substantial performance with DPA).

10 CORPORATE GOVERNANCE REGULATION THROUGH NON-PROSECUTION 8 Office or the DOJ s Criminal Division in imposed mean fines of approximately $32 million. Total sanctions imposed contemporaneously with the PDA averaged over $85 million and total sanctions imposed on the entire corporate group at the time of the PDA averaged $167 million. 30 In addition, most PDAs over the last ten years imposed various types of mandates on firms. 31 PDA mandates usually govern the design and oversight of the firm s compliance program. Many PDA policing mandates require firms to adopt a compliance program with specific features the firm otherwise would not be required to employ. 32 For example, the PDA may mandate the type of compliance information to be collected, the type and frequency of employee training, or the additional due diligence procedures or specific policies governing payments and disbursements. PDAs can also require firms to materially increase compliance expenditures. 33 Other compliance mandates simply require the firm to adopt an effective compliance program as defined by the Organizational Sentencing Guidelines. 34 Yet even these mandates can impose new duties on the firm because, but for the PDA, the firm generally could 29 Our summary data on PDAs is based on an analysis of all PDAs except those involving antitrust, environmental or tax which fall under the Antitrust Division, Environmental Division and Tax Division respectively. These divisions have different policies on PDAs from the Criminal Division and the leading U.S. Attorney s Offices. See Alexander & Cohen, supra note 1 (finding few PDAs for antitrust or environmental violations). 30 Between , PDAs imposed on publicly held firms subjected them to mean fines of approximately $41 million; the total sanction imposed on the entire corporate group at the time of the PDA was approximately $219 million, based on an analysis of our PDA data. Firms subject to particularly large penalties enforced by a PDA include JP Morgan Chase ($1.7 billion); HSBC Holdings and HSBC Bank USA ($1.256 billion); GlaxoSmithKline PLC ($1 billion, through PDA requiring firm to ensure subsidiary pays this amount); UBS AG ($500 million in 2012; this is in addition to the criminal fine imposed on UBS Japan through a guilty plea); UBS ($780 million in 2009); Adelphia Communications ($715 million); Boeing Co. ($615 million); Science Applications Int l ($500 million); KPMG ($456 million); Credit Suisse ($536 million); and Deutsche Bank ($404 million). These estimates come from a hand-collected data set on all PDAs that we crossed checked against the data set on Brandon Garrett s website. We excluded firms listed on that website that we could not confirm independently, because we found a few that were not PDAs. We also excluded PDAs involving antitrust, environmental and tax offenses because these cases are under the jurisdiction of specialized divisions that have their own guidelines governing PDAs and sentencing. Our findings are consistent with the results of Alexander and Cohen, supra note 1, Table PDA-imposed compliance program mandates also generally require firms to adopt compliance programs that differ materially from the programs firms generally adopt voluntarily. For example, whereas voluntary programs often integrate compliance efforts into the corporate divisions most directly affected by compliance efforts, the mandated programs generally require the adoption of a compliance office separate from the core workings of the firm. Finder et al., supra note 3. Moreover, voluntary programs tend to focus on addressing ethics issues that can lead to crime, and thus employ ethics officers, and not lawyers. By contrast, mandated compliance programs tend to take an enforcement approach, and generally employ lawyers as compliance officers. Id. 33 PDA compliance provisions often dictate investment levels through provisions stating that the firm has increased its compliance to a particular level (usually following negotiations with prosecutors) and agrees to maintain at least this investment in compliance going forward. See, e.g., Alpha Natural Resources, Inc. NPA and the HSBC DPA. 34 Organizational Sentencing Guidelines, 8B2.1 (listing criteria to be employed to determine whether the firm has an effective compliance program).

11 Jennifer Arlen & Marcel Kahan 9 not be sanctioned for its failure to adopt such a program 35 unless a substantive violation occurs. 36 We refer to mandates governing compliance and other efforts by the firm to detect violations of the law as policing mandates. Further, PDAs often include provisions governing internal and external oversight of the firm s efforts to comply with the law. For example, a PDA may require the appointment of a Chief Compliance Officer with authority to report directly to the board; the addition of specific independent directors; 37 the establishment of new board 38 or senior management committees; 39 or the separation of the positions of CEO and Chairman of the Board. Most PDAs with mandates also require firms to regularly report to prosecutors and other federal authorities on the firm s compliance activities. A substantial number of PDAs go even further and require firms to hire an outside monitor with authority to audit the firm to ensure its compliance with the duties imposed by the agreement and, in some cases, seek evidence of additional wrongdoing. 40 We refer to provisions governing the internal or external oversight of compliance as meta-policing duties. 35 Some firms are subject to ex ante duties to adopt compliance programs to detect specific violations; willful breach of these duties often can be sanctioned even if no substantive violation occurred. These generally are aimed at ensuring the accuracy of their financial statements and books and record. Sarbanes-Oxley Act, 15 U.S.C (2012); Sarbanes-Oxley Act, 15 U.S.C. 78j-1 (2010) (requiring existence of a capable and empowered audit committee); Foreign Corrupt Practices Act, 15 U.S.C. 78m(b)(2)(A)-(B) (2012); see also 31 U.S.C. 5318(h) (2014) (discussing compliance requirements for financial institutions to guard against money laundering). These mandates also tend to be worded as general standards and leave the board nearly complete discretion to determine the investment and structure that it believes is needed to satisfy the firm s legal duties. 36 Moreover, whereas normally directors can determine how best to comply with the Organizational Guidelines definition of effective compliance, PDA mandates, as a practical matter, shift power to a specific prosecutor to determine whether the firm s actions satisfy the standard set forth in the Organizational Guidelines, since the prosecutor is free to indict the firm if the prosecutor determines that it breached the PDA. Prosecutors have particularly strong leverage over firms with NPAs because courts have concluded that they will not review prosecutor s decisions to indict a firm deemed to be in breach of an NPA. See supra note 28. While courts may review a prosecutors decision to proceed to convict a firm that the prosecutor deems to have breached the PDA, the threat of prosecutorial action is significant since if the prosecutor does proceed she will be armed with an admissible statement of guilt made by the firm. See supra note 28 (discussing prosecutorial authority to determine whether a firm s actions constitute a violation of the PDA that warrants sanction). 37 For example, CA Technologies, Inc. was required to appoint three new independent directors to the board, including former SEC Commissioner Laura Unger. 38 For example, Monsanto s DPA required that the board create a new committee to oversee the appointment of all foreign agents and to evaluate all joint ventures; General Reinsurance Corporation s PDA required a new Complex Transaction Committee with power to reject any proposed transactions. 39 Merrill Lynch & Co., Inc. was required to create a special structured products committee of senior management to review all complex financial transactions with a third party; company X was required to create a new Disclosure Committee consisting of c-suite executives and other senior management. 40 For a detailed discussion of the monitoring provisions in these agreements see Khanna & Dickinson, supra note 2, at 1724 (discussing corporate monitor provisions in PDAs). In addition, PDAs occasionally contain mandates that are more properly characterized as prevention, rather than policing measures. Prevention measures reduce the probability of a violation, but (unlike policing measures) do not increase the likelihood of detection if a violation occurs. Mandates that alter a firm s compensation and promotion policies that make wrongdoing less attractive to employees are prevention measures. As one of us has shown, a company can be induced to undertake optimal prevention measures either through strict or through duty

12 CORPORATE GOVERNANCE REGULATION THROUGH NON-PROSECUTION 10 Table One Policing Mandates Impose through PDAs, Year Total PDAs Public firms % 60 79% 70 64% Compliance Program % 60 79% 92 84% Monitor 58 31% 26 34% 32 29% Other Mandates % 55 72% 83 76% To understand the breadth of the mandates that can be imposed, consider the PDA with Bristol-Myers Squibb (BMS) for conspiracy to commit securities fraud. Under the agreement, BMS agreed to adopt a compliance program with features specified in the PDA; to institute a training program covering specified topics; to separate the positions of Chairman of the Board and CEO; to have the Chairman participate in preparatory meetings held by senior management prior to BMS s quarterly conference calls with analysts; to have the Chairman, CEO and General Counsel monitor these calls; to appoint an additional outside director to the board, approved by the U.S. Attorney s office; to hire and pay for a prosecutor-approved corporate monitor with authority to oversee compliance with both the agreement and federal law and to report to management and the prosecutor s office; and, finally, to have the CEO and CFO make specific reports to the Chairman of the Board, the Chief Compliance Officer, the monitor, and the SEC relating to sales, earnings, budgeting and projections, and other matters. 42 C. Mandates as a New Form of Liability PDA policing mandates fundamentally change the structure of the corporate liability regime faced by publicly-held firms. The change is evident when we compare their core features with those of more traditional corporate liability regimes governing publicly held firms, both criminal and regulatory. Corporate liability rules can be distinguished along two dimensions, as shown in Figure One. The first is whether firm-level liability is strict or duty-based. Corporate liability is strict based liability regime, whereas only duty-based liability can practically be used to induce optimal policing. Arlen and Kraakman, supra note 6. Our analysis in Parts IV and V of when it is desirable to supplement harm-contingent liability generally or with PDAs, as well as our discussion of how PDAs should be structured, applies equally to PDAs with prevention mandates with one qualification. Firms tend to face strict (rather than duty-based) liability with regard to prevention measures because DOJ leniency focuses appropriately on policing. In this situation, the arguments in Sections IV.C. and IV.D. relating to the use of PDAs to address limitations with duty-based liability are not relevant to the analysis. 41 Publicly held firms include all publicly held firms and all firms that are controlled (50% or more) by a publicly held firm. 42 Bristol-Myers Squibb DPA,

13 Jennifer Arlen & Marcel Kahan 11 when the firm is liable for all violations by its employees, as under respondeat superior. Corporate liability is duty-based when the firm is subject to liability for its employees actions only if it failed to engage in proper corporate-level policing, for example by failing to have an effective compliance program, self-report or cooperate. 43 Figure One Taxonomy of Corporate Liability Regimes Is a Policing Duty Is the Imposed? Sanction Harm-Contingent? Breach can be Sanctioned even if no harm-producing crime occurs Strict Corporate Liability Policing Duty Imposed Ex Ante on All Firms Regulations imposing ex ante policing duties Firm-Specific Policing Imposed Ex Post PDA Mandates Sanction is Harm-Contingent Respondeat superior Duty-based Corporate Liability for Substantive Violations Duty-based regimes vary across a second dimension: whether liability for breach of a policing duty is harm-contingent or non-harm-contingent. Liability is harm-contingent to the extent that liability is imposed only if the firm s employees also committed a substantive violation (beyond failing to comply with any policing duties). Liability is non-harm-contingent to the extent that a firm s failure to adhere to its policing duties suffices to trigger liability. 44 The traditional corporate criminal liability regime for publicly held firms, in effect, imposes liability that is harm-contingent, as well as duty-based. A corporation with inadequate policing generally cannot be convicted unless its employees committed a substantive criminal violation. 45 By contrast, non-harm-contingent corporate liability generally is the province of regulators, such as the Securities and Exchange Commission See supra note 7 (defining policing and prevention) and text accompanying note 24 (discussing composite liability). 44 In the case of individual liability, tort liability for injuries resulting from the defendant s negligent failure to take reasonable care is an example of harm-contingent liability. Government imposed sanctions on people who breach certain legal duties (e.g., who run a red light), whether or not a harm occurs, are an example of non-harmcontingent liability. 45 A few statutes, such as the books and records provisions and effective compliance provisions of the Foreign Corrupt Practices Act, and the Suspicious Activity Report provisions and Know Your Customer provisions of the Patriot Act and Bank Secrecy Act, criminalize the willful failure to adopt or maintain an effective or reasonably compliance program. Foreign Corrupt Practices Act, 15 U.S.C. 78m(b)(2)(A)-(B) (2012); USA Patriot Act, 31 U.S.C. 5318(g), (l) (2014). These statutes impose non-harm-contingent criminal liability in theory. In practice, criminal liability for breach of these compliance provisions often is harm-contingent in that enforcement authorities tend not to enforce these provisions unless the parent or its controlled subsidiary committed a substantive violation. 46 Examples of non-harm-contingent liability are the requirement under the Foreign Corrupt Practices Act to maintain a proper system of internal accounting controls (Foreign Corrupt Practices Act, 15 U.S.C. 78m(b)(2)(B) (2012)) or the requirement under the Securities Exchange Act to have financial statements audited. 15 U.S.C. 78j-1

14 CORPORATE GOVERNANCE REGULATION THROUGH NON-PROSECUTION 12 PDAs that impose mandates supplement this regime with a new form of liability that differs from traditional corporate liability, whether criminal or regulatory. First, whereas dutybased corporate liability imposes policing duties on all firms upfront, PDA mandates impose policing duties ex post on select firms with detected wrongdoing. 47 Indeed, the duties imposed by PDAs are not merely imposed on firms ex post, but the content of the duties is often specified ex post by individual prosecutor offices, regularly with limited, if any, apparent oversight by, or guidance from, the DOJ. 48 Second, whereas the traditional corporate criminal liability regime is harm-contingent, PDA mandates impose non-harm-contingent liability: a mere breach of PDA mandates without any subsequent substantive violation can result in sanctions. PDA mandates thus in effect transform individual prosecutors into firm-specific quasi-regulators with authority to devise and impose new duties on a firm with detected wrongdoing, enforced by liability that is non-harm-contingent. DOJ policy encourages this exercise of ad hoc regulatory authority by prosecutors. 49 Calls abound for increased DOJ guidance to prosecutors on when PDA mandates should be imposed and what they should entail. 50 To provide such guidance, however, one must understand how mandates fit into the corporate liability regime and what shortcomings in the regime they are designed to address. To date, neither the DOJ nor academic commentators have provided a satisfactory analysis of these issues. The remainder of this Article seeks to fill this void. (2010). Failure to comply with these requirements exposes a firm to liability even if the underlying accounting and financial information is accurate. See supra note 45 (discussing non-harm-contingent criminal liability). 47 Accordingly, in our view these mandates are not simply a nonmonetary sanction for past wrongdoing. Compare with Khanna and Dickerson, supra note 3. Sanctions generally are backward looking in that they are designed to induce compliance with the original duty here the ex ante policing duty imposed on all publicly held firms. While the threat of PDA mandates may have ex ante effects, the specific mandates imposed create new duties to alter future conduct. 48 The Department of Justice has a decentralized approach to prosecution. Each individual United States Attorney generally exercises full authority over the content of PDAs, except in a limited set of cases (e.g., FCPA, Antitrust, Tax, and environmental) where enforcement decisions are channeled through specialized divisions within main justice. In addition, the DOJ has not provided guidelines governing the policing mandates that prosecutors can impose governing corporate policing and other internal governance matters. The few guidelines issued on mandates apply to (and limit the use of) a narrow range of provisions: extraordinary restitution, waiver of the attorney-client privilege, the firm s right to advance legal cost of their employees; and the decision to impose a corporate monitor. U.S. Att y Manual Indeed, prosecutors offices not only are given considerable discretion to create and impose duties, but to date the DOJ takes the position, supported by the limited caselaw, that that federal judges reviewing PDAs do not have authority to reject or alter specific mandates imposed unless the mandate violates the constitution, a statute or the USAM. See Arlen, supra note 9 (discussing the narrow scope of judicial review over PDAs in more detail). 49 The Organizational Sentencing Guidelines recommend that prosecutors impose a compliance mandate on firms subject to probation, but the Organizational Guidelines do not provide support for broad ex post duties. Instead, they indicate that prosecutors should require firms to adopt a compliance program that satisfies the standard of effective compliance set forth in the Organizational Guidelines. Organizational Sentencing Guidelines, 8D.1.4(b)(1). 50 E.g., Arlen, supra note 7; Garrett, supra note 3; Rachel Barkow, The Prosecutor as Regulatory Agency, in PROSECUTORS IN THE BOARDROOM: USING CRIMINAL LAW TO REGULATE CORPORATE CONDUCT (Anthony Barkow & Rachel Barkow eds., 2011.